Quantum key distribution for rf-level systems with generalized Bell states 
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Using the generalized Bell states and controlled not gates, we introduce an enatanglement-based 
quantum key distribution (QKD) of d-level states (qudits). In case of eavesdropping, Eve's infor- 
mation gain is zero and a quantum error rate of is introduced in Bob's received qudits, so that 
for large d, comparison of only a tiny fraction of received qudits with the sent ones can detect the 
presence of Eve. 
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I. INTRODUCTION 

As far as classical computation and classical commu- 
nication are concerned, binary units of memory and bi- 
nary logic gates play an inevitable and natural role due 
to the inherent simplicity of Boolean algebra on the one 
hand and their compatibility with on and off states of 
electronic switches on the other hand. With such clas- 
sical gates as NOT, AND, and OR, the simplest logical 
operations with which we are familiar in everyday life, 
and also any binary function can be implemented. They 
are also quite simple to design electronically. However 
in quantum computation and communication (see [jlj |^| 
and references therein), the main resources that have the 
potential of surpassing our conventional classical meth- 
ods, are quantum parallelism (for massive computation), 
non-locality and entanglement (for communication) and 
uncertainty relations (e.g. for Quantum Key Distribution 
among other things). For utilizing these resources, two 
level quantum states are by no means inevitable. Only 
considerations of quantum hardware should decide be- 
tween using 2-level or multi level states. At present a ma- 
jor difficulty in quantum computation is the limit on the 
number of qubits that can be coupled experimentally . 
Although it may be easier to construct universal gates for 
qubits than for qudits, the use of d-dimensional systems 
or qudits has the advantage that compared to qubits, 
fewer systems should be coupled to obtain a given dimen- 
sionality of the Hilbert space. Apart from practical con- 
siderations, it will enhance and deepen our understanding 
of the subject if we try to re-formulate quantum computa- 
tion and communications in a dimension- free context. In 
view of this, various authors have tried to generalize some 
of the algorithms, protocols, or error correcting codes of 
two level quantum computation to arbitrary dimensional 
Hilbert spaces §, § § § § g 0, || g| ||. Conse- 



quently one sees in the literature that the same basic tool 
(i.e. a generalized gate) has been defined independently 
in several works. 

For example the generalization of one of the basic gates 
of quantum computation, thats the controlled not gate 
appears to have been given independently by a number 
of authors under different names [Q, ||, ^, |l5| . The 

same is also true for the generalized Hadamard gate. Spe- 
cially in H an experimental realization of the generalized 
XOR gate to ei-levels has been proposed, where the num- 
ber n of photons in an electromagnetic mode signifies the 
state \n), n = 0, . . . , d — 1 and a Kerr interaction be- 
tween these photons and their fourier transform is used 
to induce the generalized XOR gate on the states. 

In this paper we are concerned with a protocol of 
Quantum Key Distribution (QKD) and its generalization 
to states of arbitrary dimension. Quantum Cryptography 
(QC) which is based on very simple ideas and yet not far 
from real applications as the other highlights of quantum 
computations are (like factoring large integers) is one of 
the most promising areas of research in Quantum Com- 
putation and Information. 

Particularly interesting is that in QC one tries to 
turn the apparently negative or counter-intuitive rules of 
quantum mechanics, which has resulted in epistemolog- 
ical debates in the past decades, into absolutely useful 
devices for engineering applications. One such concept 
has been the uncertainty principle, or the fact that ob- 
servation or measurement perturbs the observable. This 
rule has been utilized in a most beautiful application in 
the form of BB84 protocol for QKD where bits of 
a Key prepared by two legitimate parties, in the form of 
spin or polarization of particles in random bases, are in- 
evitably perturbed by a non-legitimate third party. (For 
a review on QC including many theoretical and practical 
issues, 

nonclassical and counter- intuitive concept, 
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has been the concept of non-locality and entanglement 
which has found even wider applications, to the extent 
that nowadays a major problem about non-locality is not 
how to interpret it, but how to measure it like other use- 
ful resources as energy and momentum. 
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The first entanglement-based protocol of QKD has 
been the work of Eckert fTs|| , which later was shown to 
be equivalent to the original BB84 protocol p9|,( see |l7j 
for finer details). Two other QKD protocols which have 
used entanglement in an essential way has been reported 
in and f^lf . The first of these uses entanglement 
swapping via Bell measurements to securely transfer a 
key and has been generalized to d-level systems in p5| . 
The second is based on local gate operations on a reusable 
EPR pair, where Alice tries to hide the secure data by 
entangling each bit with the EPR pair, sending the bit to 
Bob who can disentangle the bit and read the data. The 
strategy of Eve is to somehow entangle herself with the 
whole state of the EPR and the bit by suitable opera- 
tions and find access to the data, without being revealed 
by Alice and Bob. 

The aim of this paper is to generalize this second pro- 
tocol to higher dimensional states and at the same time 
give a clear exposition of its basics. 

For the sake of brevity, we will not go into the details 
of 2-level protocol. For this, the reader can either consult 
reference pi] ], or else go through the next sections and 
at each step set d = 2. 

The basic advantage of this protocol is that as we will 
show, not only Eve's presence will be detected by Alice 
and Bob, but also her information gain is zero, compared 
to the 50 percent information gain in the BB84 protocol. 
This is true in every dimension, but as we will show Eves 
presence introduces a higher Quantum Bit Error Rate, 
in higher dimensional states, so that her presence can be 
detected more easily. 

The structure of this paper is as follows. In section 
2 we first review some known and new facts about the 
generalized Bell states, and the generalizations of CNOT 
and the Hadamard gates to qudits. In section 3 which has 
been divided into several subsections, we generalize the 
QKD scheme of J2l| to <i-level systems, and discuss the 
security of the protocol against some individual attacks. 
We show that the information gain of Eve is actually zero 
and show how the intervention of Eve introduces an error 
rate of into the data received by Bob, and greatly 
enhances the chance of her detections by the legitimate 
parties. In all this we are concerned only with theoreti- 
cal considerations and do not consider practical issues, or 
any rigor in proving security, all these are important but 
should be considered in separate works. Finally in sec- 
tion 4 which concludes the paper, we discuss a possible 
route for generalization of our results to the continuous 
variables. Some of the calculations which are not detailed 
in the main text, are collected in the appendix. 



II. STATES, AND GATES FOR d-LEVEL 
SYSTEMS 



For qudits, a generalization of the familiar Bell states, 
has been introduced in ||, |2^, |23|, Q . These are a set of 
d 2 maximally entangled states which form an orthonor- 



mal basis for the space of two qudits. Their explicit forms 
are: 



d-l 



\3,3 



(1) 



where £ = e " and m and n run from to d— 1. These 
states have the properties (* m , n |*TO',n') = 5n,n<5 m , m > 
(orthonormality) and trace2(|5'm l n)( v I / m,n|) = (max- 
imal entanglement). The following operators f|, ^2[ 
p4| are also useful, since they play the analogous role of 
Pauli operators for qudits: 



d-l 

U m . n =Y;C l] \3+™){ ] \ 

3=0 



(2) 



For example, given the entangled state l^o.o): only one of 
the parties, say Alice, can generate any Bell state \^ m ,n) 
by acting on |*o,o) with f7 m ,„, i.e: 



(l®l/ m ,„)|*o,o) 



I*, 



(3) 



One should however note that contrary to the Pauli oper- 
ators, the operators U m , n are not necessarily Hermitian. 

One can also generalize the Hadamard gate which 
turns out to be quite useful in manipulating qudits for 
various applications ||, Q . 



H 



1 



i,j=0 



(4) 



where £ = e - ^ 1 . This operator is really not new and it is 
known as the quantum Fourier transform when d = 2". 
In that case it acts on n qubits. Here we are assuming 
it to be a basic gate on one single qudit, in the same 
way that the ordinary Hadamard gate is a basic gate 
on one qubit. This operator is symmetric and unitary 
(HH* = 1), but not hermitian. 

To generalize the NOT and the CNOT gates, we note 
that in the context of qudits, the NOT gate, is basically 
a mod-2 adder. For qudits this operator gives way to a 
raoA-d adder, or a Right-Shift gate,|, |, 
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R\j) = \j + l)mod d 
R~ x \j)=L\j) = |i-l)mod d, 



(5) 
(6) 



where L has been used to denote a left shift. Note that 
R d = 1, compared to NOT 2 = 1. 

For every unitary operator U the controlled gate U c 
which acts on the second qudit conditioned on the first 
qudit is naturally defined as follows: 



U c {\i)®\j)) = \?)®U l \j) 



(7) 



Note the difference with the qubit case. In the qubit case 
a controlled operator acts only if the value of the first bit 
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H 



the previously shared Bell state, producing the state 



FIG. 1: Circuit identity for d-level gates 



is 1, here it acts i times if the value of the first qudit is i. 
(Sometimes it is said that a controlled operator is like an 
if statement in classical computation Q . If we take this 
statement literally, then a controlled operation for d-level 
states acts like a loop.) In particular the controlled shift 
gates which play the role of CNOT gate, act as follows: 



Rc\i,j) = + 



L c \i,j) 



(8) 



Every function / from {0, 1, . . . ,d— l} n — ► {0, 1, . . . , d — 
l} m is made reversible by the definition / r (x, y) = 
(x, /(x) + y) where all additions are performed mod 
d. In quantum circuits such a function is implemented 
by a unitary operator f//|x, y) := |x. /(x) + y) where 
x e {0, 1, . . . , d - 1}™ and y G {0, 1, . . . , d - l} m . Note 
that here and in all that follows addition of multi dits is 
performed dit-wise and mod d. 

Quite analogously to the q-bits, the Hadamard and the 
Controlled Shift gates can generate all the Bell states 
^m,n)} from the computational basis states {\m, n}} 



R C (H <g> l)\n,m) = |* r 



(9) 



Many other properties of these gates are simply car- 
ried over from the case of q-bits to the general case with 
appropriate modifications. For example one can check 
the validity of the circuit identity in fig. ([!]). 



III. AN ENTANGLEMENT-BASED PROTOCOL 
OF QKD FOR d-LEVEL STATES 

In this section we generalize an entanglement-based 
protocol of quantum Key Distribution first put forward 
in plj to cHevel states and perform further analysis of 
the method. 



A. QKD in the absence of Eve 

The starting point of this protocol is the sharing of a 
Bell state |* o> = ^ J2jZo \jJ)a,b by Alice and Bob. 
The qudit to be sent is denoted by q, which is encoded 
as a basis state \q)k- Throughout the paper we use the 
subscripts a, b, k and e for Alice, Bob, key and Eve re- 
spectively. The basic idea, neglecting considerations of 
Eve's attack for now, is that Alice performs a controlled- 
right shift on \q)k and thus entangles this qudit to the 



1$) 



1 

Vd 



d-l 



3=0 



,.b.k- 



(10) 



She then sends the qudit to Bob. By this operation she 
is hiding the qudit q in a completely mixed state, since 
Pk ■= tr 0j &|$)|(«&| = ^Ifc. At the destination, Bob per- 
forms a controlled-left shift on the qudit and disentangles 
it from the Bell state, hence revealing the value of q with 
certainty. 

Note that in contrast with the BB84 protocol, here the 
key is not determined a posteriori and randomly, hence 
a larger transfer rate is possible. 



B. An individual attack by Eve 

A possible conceivable attack by Eve(e) is that she 
entangles her state to those of Alice, Bob and the inter- 
cepted key so that after Bob's measurement of the qudit, 
she can obtain partial information about the qudit. The 
best way to describe and visualize the protocol is to refer 
to fig. (g), where the qudits are drawn as lines and states 
at each stage are shown explicitly. 

The strategy that Eve follows should be described sep- 
arately for the first qudit and the rest of the qudits. For 
the first qudit, she performs no measurement and pro- 
ceeds so that her qudit gets entangled with the Bell state 
of Alice and Bob at the end of the process. For this she 
uses a controlled right-shift on her qudit conditioned on 
the value of the first qudit being sent (see fig. (0)). The 
states at various stages are as follows, where in each ket 
the qudits refer respectively from left to right to Alice (a), 
Bob(b), the key(k) and Eve(e): 



l*o> 
l$ 2 ) 



-7=^2\j,3,Ql,fya,b,k,t 
3=0 
^ d-l 



b,k,< 



3=0 
d-l 



7=jYl \j,3,Ql +3,<ll+ j) a. 



Vd 



b,k,i 



(11) 
(12) 

(13) 



3=0 



Note that choice of |0) for Eve's original state is quite 
arbitrary. Her strategy works with any other choice. In 
the last stage when Bob performs his Left-Shift gate, he 
produces the state 



I $3) = -= 



d-l 



vd 

3=0 



\j,j,Ql>qi +j)a,b,k,e 



(14) 



and thus disentangles the key and measures correctly the 
value of its first dit q\. However his shared Bell state 
with Alice has now been left entangled with the state of 
Eve, which is used again by Alice and Bob (unaware of 
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the entanglement with Eve) for the next round (i.e; for 
sending the dit g 2 of the key). Thus for the next round 
the state that Alice and Bob will start with is: 



d-l 



\j, j,92,9l +j)a,b,k,< 



(15) 



Note that we are assuming that Alice and Bob do not 
have access to a reservoir of Bell states, the later be- 
ing supposedly expensive. Thus they are using one Bell 
state for sending the whole key or at least a considerable 
fraction of it. 

It is important to note that Eve modifies her strategy 
for the next dits, by first performing a left-shift, measur- 
ing her qudit and then performing a right-shift on her 
qudit. The rest of the process is like that for the first 
qudit (see fig. (Q)). The various states in different stages 
shown in the figure are as follows: 



d-l 



1*0} 



-r=y2\j,3,Q3,j + qi)a,b,k,, 



3=0 
d-l 



I* 



j,92 +j,j + qi)a,b,k,e 



(16) 



(17) 



. d-l 

1*2) = -y=y2\j > j,Q2+j,Ql-Q2)a,b,k,e ( 18 ) 

At this stage Eve who has disentangled her qudit from 
the rest of the state measures her own qudit to be q\ — q%- 
She then performs the controlled right shift on her qu- 
dit to restore the original state At the destination 
Bob again proceeds as before, performs his left shift and 
measures the value of qi , leaving the state of Alice, Eve 
and his own state, in an entangled state ready for use in 
the next round. 

In this way Eve intercepts the qudits 

9i - 92,9i - 93,9i - 94, ■ ■ ■ 

from which she can infer all the sequence by checking d 
possible values for q±. 

Note that for each qudit, Eve is effectively doing an 
intercept-recent strategy, however she does not intercept 
the value of the qudit (say q 2 ) sent by Alice, but she 
measures a value qi — q± , where qi is the value of the first 
sent qudit which has been intercepted in an earlier stage. 



C. Protection against Eve's intervention 

To protect this protocol against this kind of attack, 
Alice and Bob proceed as follows: Before sending each of 
the qudits, Alice and Bob act on their shared Bell state 
by the Hadamard gates H and if*, respectively. The key 
point is that a Bell state \i/jqo) disentangled from the 
outside world is unchanged under this operation, while a 
state entangled with outside is not: 



(H®H*)\* ,o) = I* 



0,0/ 



(19) 



In the absence of intervention of Eve, this extra operation 
has no effect on the protocol. 

In fact the shared Bell state is unchanged under more 
general operators of the form U ® U*, where U is any 
unitary operator. We will investigate this possibility in 
appendix B. 

It is clear from fig. (g) , that for the first qudit nothing 
changes. However for the second qudit and other qudits, 
essential changes occur in the intermediate states in the 
process. As we will see, in this way Alice and Bob can 
prevent Eve from getting any useful information. The 
entangled state of Alice, Bob and Eve remained from the 
first round is 



d-l 



\X) = -7j^2\j,j,3 +qi)a,b,e 
3=0 



(20) 



When Alice and Bob perform their Hadamard gates on 
their qudits, this state changes to 



d-l 



iJ,k—0 



(21) 



Thus the second round of the protocol after Alice inserts 
the second dit of the key, starts with the state 



d-l 



l*o) = -7= ^2 H i ^Hl J \i 1 k 1 q 2 ,i + qi) a ,b,k,e 

(22) 

The state which results after Alice's controlled R 
operation will be: 



l*i) 



1 



H i,3 H k,j I*! fc , i + 92, j + qi)a,b,k,, 



(23) 



The qudit is now sent to Bob. We will show in appendix 
A, that this new state has no information for Eve. In 
fact we will show that, the density matrix of her system 
and the qudit will be 



Pk,e 



t, 



(24) 



Therefore under any unitary operation on her qudit and 
the sent qudit whether it be the controlled L gate used 
for the first round or a more complex cleverly chosen 
operator, she will not be able to get useful information 
from the intercepted data. More generally it is hardly 
possible for Eve that by a quantum operation derived 
from suitable interactions with her ancillas, can derive 
any useful information from this density matrix. 



D. The information gain of Eve 

The above situation is analogous to the case of BB84 
protocol, where with respect to any basis chosen by Eve, 
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Alice Operation Eve Operation Bob Operations 
FIG. 2: Eve attack for the first qudit 
$0 *1 *2 *i 




Alice Operation Eve Operations 

FIG. 3: Eve attack for next qudits 



Bob Operations 



the density matrix of the qubits intercepted by Eve are 
identity matrices. However there is one major difference 
in that in the BB84 protocol and its variations and gener- 
alizations to higher dimensional states, the protocol ends 
up with a public announcement of the bases of Alice and 
Bob, from which Eve finds that she has intercepted a 
fraction of the qubits or qudits correctly. Therefore Eve 
finds partial information about the key and only her re- 
vealing by Alice and Bob saves those protocols. Here we 
will show that the information gain of Eve is actually 
zero and she obtains no information at all about the key. 
The mean information gain per bit of Eve /, is the differ- 
ence between two relative entropies and is interpreted as 
the percentage of bits which are saved when Eve wants 
to write the data of Alice from her own intercepted data 
Wk- We have: 



I = H a 



priori 



H a posterieri 



(25) 



Assuming that Alice sends the qudits uniformly, we have: 
-Hapriori = log 2 d. We also have: 

H a posteriori = - ^ p(r)p{i \r ) log 2 p(i \r) (26) 

r 

where p(r) is the probability that Eve receives a dit value 
of r and p(i\r) is the a posterieri probability that Alice 
has sent a dit value of i given that Eve has received a 
dit value of r. The later can be easily calculated from 
Bayes's formula 



p(i\r) = 



P{i)p{r\i) 



(27) 



Since Alice is assumed to send the dits uniformly, we 
have p(i) — 4 and since the density matrix of Eve is 
unity, p(r\i) = 4, thus we find: p(i\r) = 4. Inserting all 
this in we find that H a posteriori = log 2 d = H a priori 
and hence zero information gain for Eve. This is a very 
interesting property of this protocol compared with the 
BB84 protocol and its variations or generalizations to 
higher dimensional systems where the information gain 
of the Eve is non-zero. In fact in the BB84 protocol 
the 50 percent information gain is due to those occasions 
where the basis of Eve happens to be the same as the 
publicly announced bases of Alice and Bob. Here there 
is no public announcement of any kind and so all the dits 
that Eve measures are really worthless at the end of the 
protocol. 



E. Detection of Eve 

At this stage we want to show how Alice and Bob can 
infer the presence of Eve from comparison of their data. 
Although by no unitary operation on her system and the 
key, she can gain information from the key, she may want 
to use a clever operation to reduce as much as possible 
the Quantum Bit Error Rate (QBER) introduced into 
the data received by Bob, and hence her chance of being 
detected. The QBER depends on her choice of the op- 
eration. Suppose that she performs the same sequence 
of (Controlled R + measurement + controlled L ) oper- 
ations that she was doing in her successful attacks. It 
is straightforward to see that with the preservation of 



6 



Hadamard gates, the new state that reaches Bob, pro- 
vided that the qudits q\ and q 2 have been sent and Eve 
has measured a qudit value of q in the second round is: 



1*3) = E H - 



TT* 



i,i+qv-qi+q 1J -k,i+q 2 -q 1 +q 



i,k=0 



\i,k,i + q 2 ,q)a t b,k,' 



(28) 



After Bob performs his controlled- L operation, the final 
state ready for measurement will be: 



d-i 



|4> 



E 



4/ — / , 11 i,i+q2-qi+q 11 k,i+q 2 ~qi+q 
Z,fc=0 



\i, k,i + qi — k,i + q + q 2 ) 



(29) 



It is again a simple computation to find the density 
matrix corresponding to the Key space from this state, 
which turns out to be 



Pk ■= tr QiM |$4)($4| = -jlfc- 
a 



(30) 



This means that Bob measures all the values of the key 
qudit with equal probability and his chance of getting 
the correct qudit is 4 . Hence the QBER introduced into 
the data by Eve's intervention is ^r- 



IV. DISCUSSIONS 

We have studied a protocol of quantum key distribu- 
tion for cZ-level systems based on shared entanglement of 
a reusable Bell state and have shown that in this protocol, 
the information gain of Eve is zero and the Quantum Bit 
Error Rate (QBER) introduced by her interception into 
the data received by Bob is =^r- The situation is simi- 
lar to the generalizations of the BB84 protocol to higher 
dimensional states Jll| |l3) in which the larger the 
number of states, the larger is the QBER, which in turn 
may be larger than any noise already present in the chan- 
nel. This later fact seems to be an advantage in terms of 
the security of the key distribution scheme |2jJ. These 
results are based only on the analysis of a direct individ- 
ual attack by Eve. It may be interesting to study further 
types of attacks and to establish theoretical bounds to 
the information gain and the QBER in this protocol or 
go through a general analysis along the lines that have 
been followed for the BB84 protocol in 
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and to 

see if this protocol has an unconditional security or not. 

Another route for extending our results is to consider 
the continuous variables. There has been a lot of interest 
toward quantum computation and quantum communica- 
tion with continuous variables in the past couple of years 
(see [EM pj| and references therein), where instead of bits, 
information may be stored in infinite dimensional states 
like position or momentum of a particle or amplitude 
of an electromagnetic field. Part of this interest derives 
from the fact that it has been shown that a combination 



of optical devices like phase shifters and beam splitters 
may be sufficient to act as a set of universal gates. There- 
fore many algorithms and protocols have been re-studied 
for continuous variables |29| . Now that we have a QKD 
protocol for d-level states for any d, a natural question 
arises whether it is possible to go to a proper continuous 
limit and define the above process for continuous vari- 
ables. We can simply replace the discrete states |j) with 
continuous variables \x),—oo < x < 00 and £ = e~ 



with £ 



„27Tl 



in all the formulas for states and operators 



to adapt the protocol to the continuous variables. In all 
stages we need also change summations to integrations: 



d-l 

— T 



1 



-Hoc 



dx 



(31) 



Following these we will find the generalized Bell states in 
the continuous case: 



I*a,/J) = 



1 



/2tt 



i(3x 



x. x + a) dx 



(32) 



where a and fi are continuous labels ranging from — 00 to 
+00 and I a;) is a continuous state like position and all the 
integrals now and hereafter are over the real line. These 
states are normalized in the sense that 

(*a,/»|*a',/J') = S(a - a')S(f3 - /?') (33) 

and are maximally entangled in the sense that 

1 [ +ca 

trace 2 (|*a,/3)(*a,/3|) = — / \x){x\dx. 

The generalization of the Hadamard operator is nothing 
but the Fourier transform operator which has already 
been used in (2{J to generalize the Grover algorithm 
to continuous domain. 



H\x) = 



1 



xy \y)dy 



(34) 



The controlled right shift operator now takes the form 

R c \x,y) = \x,x + y) (35) 
which as an operator takes the particularly simple form 



R c 



-iX0P 



(36) 



This operator has also appeared already in (s| . To define 
the form of the protocol for the continuous variables, it 
is enough to modify all the states in various stages of 
the protocol as stated above. It may then be practically 
more feasible to really implement this protocol by optical 
means. 



APPENDIX A 

In this appendix we show that Eve can not counteract 
the action of the Hadamard gates by replacing her con- 
trolled shift gate by any other unitary operator or even 
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by any quantum operation. Therefore any measurement 
of her system or the intercepted qudit will reveal nothing 
to her. 

When Eve intercepts the sent qudit, she will have ac- 
cess to the last two parts of the following state: 



operator. Suppose that Alice or Bob use an operator 
U instead of H, either deliberately or else by unwanted 
errors in their gates. To find the information gain of Eve, 
we need to calculate as in appendix [a| the density matrix 
Pk.e = tr a , 6 (|3 2 )(3 2 |), where |3 2 ) is 



j d-i 

|*2> = — r= 52 H i,0 H k,j\h k ^ + (l2,3 +qi)a,b,k,e 
vrf , TTLn 

(Al) 



i : j,k— 



One can now find the density matrix of Eve and the 
sent qudit from p^ e — tr Qj h(|4 , 2 )( x I > 2|)- Using the primed 
dummy indices like i' ,f ... for the bra state (^l we have: 

P k ' e = 7^52 HijHljH*,j,Hk'j'SwSkk' 

\i + q2,j + qi){i' + q2,j' + qi\ (A2) 
Summing over i' , kl we find: 

Pk > e = 1 52 H ij H kj H ij' H kj' 



\i + Q2,j + qi){i + Q3,j' + Qi\ 



(A3) 



Summing over k and using the symmetry and unitarity 
of H (^2 H^-Hkj' = Sjji) and then summing over j' we 
obtain: 

Pk > e = \ 52 // '. // -',' ' + 92, j + qi)(i + 92, j + qi I 

(A4) 

Now we use the definition of Hij :— ;^C y > to set 

HijH*j = 2- The last step is done by a relabelling of 
the indices i + g 2 and j + q± to end with 



Pk ' e = \l,m)(l,m\ = il fe (g) 1 



/ . m 



d 2 ' 



APPENDIX B 



(A5) 



In this appendix we investigate the consequences of 
replacing the Hadamard gates with an arbitrary unitary 
gate U. As stated in the text, the Bell state |\&o.o) 1S 
invariant under the action of U ® U* for any unitary 



d-l 



l"2> = ~J= 52 U i,3 U k,j\h k ^ + q2,3 + Q.\)a,b,q,e 

(Bl) 



i^j,k— 



The calculations are similar to appendix |X[ and the final 
result is: 



d-l 



Pk, 



i,3=0 



\i + Q2,3 + qi)k,e{t + q2,j + qi\ 

(B2) 

Thus if the operator U shares only the property with 
the Hadamard gate that |t/i,j| 2 = h, then again we will 
have pk, e = ® l e and the information gain of Eve 
reduces to zero. In this sense the protocol is somehow 
robust against a large number of errors in the Hadamard 
gates. 

Secondly we can repeat the calculation that lead to the 
final density matrix of the key dits in the hands of Bob, 
eq. (30), to determine the new QBER. This time we have 



d-i 



p 4 > = 



52 ^*ii+93-9i+«^k,i+«a-9i+9 



i,fe=0 



\i, k, i + Q2 - fc, i + q + q2) 



(B3) 



It is again a simple computation to find the density ma- 
trix corresponding to the Key space from this state: 



Pk ■= tr ajbje |34)(3 4 | 



M+92-91+9I 



'■Wk, 



i+q2-qi+q\ 



\i + Q2- k) k (i + (?2 - fc| 



(B4) 



Again if for | Ui 



4 , we will obtain a completely mixed 



matrix and the same QBER as with the Hadamard 
gates. 
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